312-50 Exam Dumps and Practice Questions

The correct answer is B because an ACK scan is mainly used to determine firewall filtering rules, not to identify services or directly confirm open and closed ports. In CEH scanning methodology, an ACK scan sends TCP packets with only the ACK flag set and analyzes how the target or intermediate firewall responds. CEH material states that ACK probe scanning helps identify filtering systems: if an RST packet is returned, packets to that port are not being filtered; if there is no response, a stateful firewall is likely filtering the packet. Another CEH exam-focused reference similarly notes that ACK probes check filtering at the remote end; no response indicates a stateful firewall between the attacker and host, while an RST response indicates there is not. Services are better identified through version detection or banner grabbing, while open ports are commonly identified with SYN or TCP connect scans. Therefore, the best CEH answer is firewall rules.

The Forbidden attack exploits nonce reuse in Galois/Counter Mode, particularly AES-GCM. GCM is an authenticated-encryption mode that provides confidentiality and integrity, but its security requires a unique nonce for every encryption performed under the same key. Repeating a nonce causes the counter-mode keystream to be reused and creates algebraic relationships between authentication tags. With suitable ciphertext-tag pairs, an attacker may recover information about the authentication process and generate forged data that the receiver accepts as valid.

That outcome precisely matches the scenario: encrypted contents initially remain unreadable, cryptographic values expected to be unique recur across sessions, and the tester ultimately constructs an authenticated forgery. CRIME instead exploits compression-related information leakage in TLS. MITM describes an attacker's network position but does not by itself explain the nonce-reuse forgery. MITB involves malicious code operating within a user's browser.

The proper controls include generating nonces according to the authenticated-encryption specification, preventing counter resets after restarts, avoiding key-and-nonce reuse across distributed systems, monitoring nonce-generation failures, and rotating affected keys. Research into practical GCM forgery attacks found that repeated nonces can fully break connection authenticity. Practical Forgery Attacks on GCM in TLS

CEH v13 explains that Windows systems running older or default configurations often allow anonymous or null session connections to IPC$ shares, enabling attackers to enumerate users, groups, shares, and other system details without authentication. Null session enumeration is highlighted as a classic yet effective technique because it generates minimal detectable activity and does not require credentials, making it ideal for stealth operations. CEH stresses that SMB null sessions are frequently overlooked in legacy or poorly hardened environments, especially when default permissions remain unchanged. Packet sniffing (Option A) may provide some data but requires traffic visibility and may be detected through monitoring tools. DNS zone transfers (Option B) require misconfigurations and usually do not reveal user list details. SNMP queries (Option D) require community strings and often generate alerts. Therefore, exploiting null sessions is the most covert and effective method for enumerating Windows systems under default configurations.

The best answer is Corporate Espionage. CEH reconnaissance coverage explains that footprinting can be used not only for technical attack preparation but also for competitive intelligence gathering against organizations. In this scenario, a rival company appears to have derived meaningful strategic information about product design, pricing, and roadmap decisions from publicly available data and external disclosures before launch. The resulting harm is not just accidental exposure in the abstract; it is the use of collected intelligence to gain a business advantage over the target organization. That makes corporate espionage the most accurate classification. Information leakage is certainly part of the pathway, because some information had to be exposed or inferable from public sources, but the threat asked for is the footprinting-related consequence represented by the competitor's behavior. Business loss describes an impact, not the threat category itself. Social engineering would require manipulative interaction with people, which is not stated here. CEH materials note that careless public disclosures, metadata, career postings, partner information, and strategic announcements can all support footprinting by competitors or adversaries. When such data is systematically collected to mirror or undermine business strategy, the activity is best described as corporate espionage.

The correct answer is B because massive outbound HTTPS traffic is a strong indicator of data exfiltration, especially when it is designed to blend into normal web traffic. In CEH attack lifecycle concepts, exfiltration occurs after an attacker gains access and can quietly extract protected resources or sensitive data from the environment. The retrieved CEH-aligned material describes exfiltration as the phase where an attacker with elevated access can ''quietly extract data,'' and notes that exfiltration can occur silently. HTTPS is commonly allowed outbound in enterprise networks, so attackers may use it as a covert or low-noise channel to move stolen files, credentials, database dumps, or archives to an external server. The guide material also notes that malware often uses SSL over port 443 or other easy-to-hide mechanisms rather than obvious suspicious ports. DoS usually creates service disruption, scanning generates probing patterns, and reconnaissance focuses on information gathering. Massive hidden outbound HTTPS most likely indicates data exfiltration.